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(57) Abstract: The invention provides a method for assessing risk within an organization, comprising: defining one or more zones 
(2), each of the one or more zones comprising an environment; identifying one or more assets (4) of the organization, each of the 
assets being located in a respective one of the zones; conducting a respective impact assessment (6) for each of the assets, ea' 
sessment comprising assessing the impact of the loss of the respective asset; conducting for each of the zones a respective/ 
assessment (8a), comprising assessing the risk level associated with placing a respective asset within the respective cor 
zone; and conducting for each asset a respective asset risk assessment (8b), comprising assessing the risk level assocr 
respective asset independent of the respective zone of the respective asset; and assessing risk on the basis of at leasUh 
ment, the zone risk assessments and the asset risk assessments. The invention also provides a risk managements 
assessing risk according to the method described above and managing said risk. 
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